What?

Reflects any access control restrictions applied to Auth fields in the UI. I.e. if email has update: () => false the field should be displayed as read-only.

Why?

Currently any access control that is applied to auth fields is functional but is not matched within the UI.

For example:

• password that does not have read access will not return data, but the field will still be shown when it should be hidden
• email that does not have update access, updating the field and saving the doc will not update the data, but it should be displayed as read-only so nothing can be filled out and the updating restriction is made clear

How?

Passes field permissions through to the Auth fields UI and adds docs with instructions on how to override auth field access.

Testing

Use access-control test suite and auth collection. Tests added to access-control e2e.

Fixes #11569